modiloader | a610aef74fae3f178f3c3752ba83a6e7b8ea82bab12d66471eb48240c02779c1 | Triage

Submit
Reports

Overview

overview

Static

static

7

ffd2b60afb...18.exe

windows7-x64

ffd2b60afb...18.exe

windows10-2004-x64

7

Sharing

General

Target

ffd2b60afb1bca2bcb10f837c46f074d_JaffaCakes118
Size

818KB
Sample

240930-djcnjsyfrh
MD5

ffd2b60afb1bca2bcb10f837c46f074d
SHA1

4af2f056647ad58f775ae5715e0e349c45ee0ce7
SHA256

a610aef74fae3f178f3c3752ba83a6e7b8ea82bab12d66471eb48240c02779c1
SHA512

d88932d047ee5dd4d8fcc01eba3562f944ecd27cfc951682d4cf1a3edf5d4c15e05d117036952564c669a72a8cae8d33f6b0d7adab5b23f0cda71d204b1d3bd8
SSDEEP

12288:cUDrWv1r25ge9RHRvcJvKe8uabWhM/QZLAgtvDLkegot1ysvRDvMc2qCGe6XsHAY:cUDS9q51RxyKe8uLdZsgtvkJ/KbMVAN

Score

10^/10

modiloader discovery evasion themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

ffd2b60afb1bca2bcb10f837c46f074d_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery evasion themida trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

ffd2b60afb1bca2bcb10f837c46f074d_JaffaCakes118.exe

Resource

win10v2004-20240910-en

discovery evasion themida

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  ffd2b60afb1bca2bcb10f837c46f074d_JaffaCakes118
- Size
  
  818KB
- MD5
  
  ffd2b60afb1bca2bcb10f837c46f074d
- SHA1
  
  4af2f056647ad58f775ae5715e0e349c45ee0ce7
- SHA256
  
  a610aef74fae3f178f3c3752ba83a6e7b8ea82bab12d66471eb48240c02779c1
- SHA512
  
  d88932d047ee5dd4d8fcc01eba3562f944ecd27cfc951682d4cf1a3edf5d4c15e05d117036952564c669a72a8cae8d33f6b0d7adab5b23f0cda71d204b1d3bd8
- SSDEEP
  
  12288:cUDrWv1r25ge9RHRvcJvKe8uabWhM/QZLAgtvDLkegot1ysvRDvMc2qCGe6XsHAY:cUDS9q51RxyKe8uLdZsgtvkJ/KbMVAN
Score

10^/10

modiloader discovery evasion themida trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasionthemidatrojan

behavioral2

discoveryevasionthemida

© 2018-2025

Terms | Privacy